FortiGate evaluates SD-WAN traffic against configured service rules, considering source and destination addresses, application identification, performance SLA status, and eligible forwarding members.
Option D is correct because SMTP traffic matches SD-WAN service rule 3, which permits load balancing across six overlay interfaces belonging to the HUB1 and HUB2 zones.
Service 2: Although the source IP address 10.0.1.124 matches its configured source range, this rule specifies Facebook, LinkedIn, and gaming applications. SMTP traffic does not satisfy these application-matching criteria.
Service 3: The rule matches the following conditions:
Source: 10.0.1.0–10.0.1.255
Destination: 10.0.0.0–10.255.255.255
Strategy: Lowest Cost (SLA), with round-robin load balancing
Members: Six VPN interfaces across HUB1 and HUB2
The diagnostic output shows that all six members are alive and selected.
Although sla(0x0) and num of pass(0) indicate that none meets the configured SLA target, FortiOS can still load balance across the tied, operational members when all fail their SLA thresholds.
Therefore, FortiGate can distribute qualifying SMTP sessions among HUB1-VPN1, HUB1-VPN2, HUB1-VPN3, HUB2-VPN1, HUB2-VPN2, and HUB2-VPN3, assuming valid destination routes.
Options A and C incorrectly restrict the eligible interfaces, while option B disregards the matching SD-WAN service rule.
